finance36-et90[.]pro

The domain finance36-et90.pro was registered through NameCheap, Inc. on 15 May 2026 and currently resolves to the IP address 104.21.48.53, which is hosted on a cloud‑based service provider. Within a few weeks of its appearance, the domain has been added to three independent security blocklists and has triggered detections by four of ninety‑one VirusTotal scanners, indicating that a minority of anti‑malware engines have identified malicious behavior. Browser‑based protection extensions have also taken action: the PhishDestroy, MetaMask, and SEAL extensions report the site as blocked, suggesting that the domain is being used to deliver credential‑stealing or other phishing content.

No public Safe Browsing verdict, Open Threat Exchange entry, SSL certificate details, HTTP response codes, or page title information have been disclosed, leaving the exact content and delivery mechanisms unverified. The limited visibility of the hosting infrastructure, combined with the early blocklist listings, points to a rapidly deployed phishing campaign that may target financial‑related credentials.

Defenders should add finance36-et90.pro to local deny‑list rules for DNS and proxy filters, monitor outbound connections to 104.21.48.53 for anomalous traffic, and enforce multi‑factor authentication for any services that could be impersonated. Continuous ingestion of updated blocklist feeds and periodic re‑scans of the domain with sandbox services are recommended to capture any evolution of the payload or additional indicators of compromise.